From c802f3d6f326fea40d84001899f610298f389758 Mon Sep 17 00:00:00 2001
From: Grace Ruan <106621189+GraceRuan@users.noreply.github.com>
Date: Tue, 14 Jan 2025 10:43:02 -0800
Subject: [PATCH] Test/check token (#9)

* test: add check token job

* fix: modify the actual secret jwt name

* fix: format the check token

* fix: checkout sh file

* test: change to workflow_call

* fix: format to use workflow_call

* fix: use different variable name for broker

* fix: convert input to env in workflow_call

* fix: only pass secrets in workflow_call

* fix: secrets inherit

* fix: add secrets in workflow_call

* fix: use secrets in workflow_call

* fix: no type for secrets

* fix: use inputs and secrets directly in workflow_call

* feat: use composer to generate pipelines

* fix: remove sh script
---
 .github/workflows/build-release.yaml |  5 ++++
 .github/workflows/check-token.yaml   | 37 ++++++++++++++++++++++++++++
 .github/workflows/deploy.yaml        |  6 +++++
 3 files changed, 48 insertions(+)
 create mode 100644 .github/workflows/check-token.yaml

diff --git a/.github/workflows/build-release.yaml b/.github/workflows/build-release.yaml
index 2aa3c1e..c72a9a4 100644
--- a/.github/workflows/build-release.yaml
+++ b/.github/workflows/build-release.yaml
@@ -20,9 +20,14 @@ env:
   SERVICE_NAME: java-maven-pipeline-example
 
 jobs:
+  check_token_expiration:
+    uses: ./.github/workflows/check-token.yaml
+    secrets:
+      token: ${{ secrets.broker_jwt_0e727e83_f027_426a_a31c_d7c1cceaddf6 }}
   build-release:
     name: Build and release
     runs-on: ubuntu-latest
+    needs: check_token_expiration
     permissions:
       contents: read
       packages: write
diff --git a/.github/workflows/check-token.yaml b/.github/workflows/check-token.yaml
new file mode 100644
index 0000000..6b09c80
--- /dev/null
+++ b/.github/workflows/check-token.yaml
@@ -0,0 +1,37 @@
+name: Check token expiration
+
+on:
+  workflow_call:
+    inputs:
+      url:
+        description: "The Broker URL"
+        default: https://broker.io.nrs.gov.bc.ca
+        type: string
+    secrets:
+      token:
+        description: "The Broker token"
+        required: true
+
+jobs:
+  check-jwt:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check token expiration
+        shell: bash
+        run: |
+          RESPONSE_CODE=$(curl -o /dev/null -s -w "%{http_code}" -X 'GET' \
+            ${{ inputs.url }}/v1/health/token-check \
+            -H 'accept: */*' \
+            -H 'Authorization: Bearer '"${{ secrets.token }}"'' \
+            )
+
+          if [ "$RESPONSE_CODE" -eq 401 ]; then
+            echo "Unauthorized (401)"
+            exit 1
+          elif [ "$RESPONSE_CODE" -eq 403 ]; then
+            echo "Invalid JWT: Block list has match"
+            exit 1
+          else
+            echo "Response code: $RESPONSE_CODE"
+          fi
\ No newline at end of file
diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
index 8808975..fbd7cdb 100644
--- a/.github/workflows/deploy.yaml
+++ b/.github/workflows/deploy.yaml
@@ -20,10 +20,15 @@ env:
   PACKAGE_REPO: https://maven.pkg.github.com/bcgov/java-maven-pipeline-example
 
 jobs:
+  check_token_expiration:
+    uses: ./.github/workflows/check-token.yaml
+    secrets:
+      token: ${{ secrets.broker_jwt_0e727e83_f027_426a_a31c_d7c1cceaddf6 }}
   deploy-build:
     name: Deploy development version
     if: ${{ ! startsWith(github.ref, 'refs/tags/') }}
     runs-on: ubuntu-latest
+    needs: check_token_expiration
     outputs:
       project_version: ${{ steps.set-build-output.outputs.project_version }}
       build_guid: ${{ steps.set-build-output.outputs.build_guid }}
@@ -94,6 +99,7 @@ jobs:
     name: Deploy release version
     if: ${{ startsWith(github.ref, 'refs/tags/') }}
     runs-on: ubuntu-latest
+    needs: check_token_expiration
     outputs:
       project_version: ${{ steps.set-tag-output.outputs.project_version }}
       build_guid: ${{ steps.set-tag-output.outputs.build_guid }}